China’s Personal Information Protection Law, which is still in the process of being fleshed out through implementing regulations and official guidance, provides a regulatory framework that governs the cross-border transfer of personal information. This article focuses on PIPL and the transfer mechanisms it proposes to safeguard personal information transferred out of China. Note that the PIPL is only one piece in the patchwork of Chinese legislation that addresses cross-border data transfers, a... Read More

The Personal Information Protection Law is the first law dedicated to protecting personal information in China, provides comprehensive penalty and enforcement mechanisms, including administrative penalties, private actions, public interest actions (China’s equivalent of class actions), public security administration, and criminal penalties. Every individual or organization that acts as a data handler, including state organizations as stipulated in Article 33, will be subject to the enforcement o... Read More

China's Personal Information Protection Law introduces the position of "personal information protection officer" — akin to the data protection officer role under the EU General Data Protection Regulation. When the amount of personal information processed by an organization reaches the threshold specified by the national cybersecurity administration authority, it is mandatory to appoint a PIPO to supervise the processing activities and protective measures implemented.  Definition of personal inf... Read More

The Personal Information Protection Law of the People’s Republic China entered into force Nov. 1, 2021. As the first comprehensive personal data law of China, the PIPL imposes a number of legal obligations on businesses in relation to the collection, processing, provision, transfer, deletion and destruction of personal data. Obligations of 'PIPs' under PIPL Under the PIPL, personal information processor is the primary obligor in handling personal information. A PIP refers to an organization or... Read More

In this five-part series, we examine several facets of the Personal Information Protection Law of the People’s Republic of China, which came into force Nov. 1, after two rounds of public consultation. The drafting of the PIPL was heavily influenced by the EU General Data Protection Regulation, and follows GDPR closely in many areas. However, it has distinct features, scope and exclusions that global companies need to understand. A key threshold distinction between the GDPR and the PIPL relates... Read More

The top legislative body in the People's Republic of China voted Friday to adopt a new national privacy law. The Standing Committee of the National People's Congress passed the Personal Information Protection Law at a meeting in Beijing, according to the nation's state-operated Xinhua News Agency. The sweeping law will take effect Nov. 1. With the move, the PRC joins three of the world's top four economies with an omnibus privacy law, leaving the U.S. as the only nation in the top four without ... Read More